Microsoft Security Bulletin Advance Notification for December 2012 contains seven bulletins; five critical and two important.

Bulletin 1 adversely affects Internet Explorer 9 & 10, but not 6, 7, and 8, which is unusual. On IE9, it fluctuates from being rated moderate to critical depending on the platform. Since it is a browser vulnerability this should be the first of the patch triage list, as a victim could be compromised by visiting a malicious site via drive-by attack.

With this update, Microsoft will also harden IE6, IE7, and IE8, even though they aren't vulnerable to these vulnerabilities. The vulnerabilities only exist in IE9 and IE10.

Bulletin 3 is a critical bulletin that affects the Microsoft Office suites. Bulletin 3 patches vulnerabilities that are typically used in targeted attacks by sending victims malicious documents. Office updates sometimes fall through the cracks from a priority stand point, but Outlook can be exploited simply by viewing emails, so this should be patched as a priority. Exploits related to this type of bulletin have a long shelf life.

Bulletin 4 is interesting because it fixes vulnerabilities in Microsoft Exchange Server 2007 Service Pack 3, Microsoft Exchange Server 2010 Service Pack 1, and Microsoft Exchange Server 2010 Service Pack 2. This is probably related to Oracle recently updating Outside In, which is used by Microsoft Exchange.

Bulletins 2 and 5, also rated as critical, will affect most consumers and enterprises since they fix vulnerabilities that would allow an attacker to remotely execute code on all Windows platforms. Both of these bulletins fix vulnerabilities that potentially could be leveraged as web-based attacks, however they would be difficult to exploit and achieve remote code execution.

Bulletin 6 is rated as important and affects all supported Microsoft operating systems except for Windows RT. Since it's rated as important it probably requires a special set of circumstances to actually exploit, which would probably require some sort of victim participation such as opening malicious files.

Bulletin 7 is important and only affects Windows Server 2012 and Windows Server 2008 R2. It could allow an attacker to bypass at least one security measure on those operating systems. Since it is rated as important it may only work under limited circumstances and configurations.

Spotlight

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Learn about personal data bankruptcy and the cost of privacy, security and compliance, delivering digital security to a mobile world, and much more.

As ISPs, hosting providers and online enterprises around the world continue suffering the effects of DDoS attacks, often the discussions that follow are, “What is the best way to defend our networks and our customers against an attack?”

The code redirects visitors to another URL where the Fiesta exploit kit is hosted, which then tries to detect and exploit several vulnerabilities in various software. If it succeeds, the visitors are saddled with a banking Trojan.

Looking for an Android-based tablet for your child but don't know which one to choose? If you are concerned about the device's protection against random hackers, Bluebox Security has just released a review of the nine most popular Android tablet models aimed specifically at children.